Cyber Posture

CVE-2026-23669

High

Published: 10 March 2026

Published
10 March 2026
Modified
24 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23669 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 27.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation of Remote Services (T1210) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely flaw remediation directly patches the use-after-free vulnerability in RPC Runtime, preventing exploitation as recommended in the vendor advisory.

prevent

Memory protection safeguards such as ASLR and DEP mitigate exploitation of the use-after-free vulnerability by protecting against unauthorized memory access.

preventdetect

Vulnerability scanning identifies the CVE-2026-23669 use-after-free flaw in RPC Runtime, enabling timely remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Use-after-free in RPC Runtime enables remote low-priv RCE, directly facilitating exploitation of remote services (T1210) and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Use after free in RPC Runtime allows an authorized attacker to execute code over a network.

Deeper analysisAI

CVE-2026-23669, published on 2026-03-10, is a use-after-free vulnerability (CWE-416) in the RPC Runtime. It carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and potential for significant impacts.

An authorized attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network without requiring user interaction. Successful exploitation enables arbitrary code execution, compromising confidentiality, integrity, and availability to a high degree.

Microsoft's advisory provides mitigation details, including patches, in the update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23669. Security practitioners should consult this resource for deployment instructions and workarounds.

Details

CWE(s)

Affected Products

microsoft
windows 10 1607
≤ 10.0.14393.8957 · ≤ 10.0.14393.8957
microsoft
windows 10 1809
≤ 10.0.17763.8511 · ≤ 10.0.17763.8511
microsoft
windows 10 21h2
≤ 10.0.19044.7058 · ≤ 10.0.19044.7058 · ≤ 10.0.19044.7058
microsoft
windows 10 22h2
≤ 10.0.19045.7058 · ≤ 10.0.19045.7058 · ≤ 10.0.19045.7058
microsoft
windows 11 23h2
≤ 10.0.22631.6783 · ≤ 10.0.22631.6783
microsoft
windows 11 24h2
≤ 10.0.26100.7979 · ≤ 10.0.26100.7979
microsoft
windows 11 25h2
≤ 10.0.26200.7979 · ≤ 10.0.26200.7979
microsoft
windows 11 26h1
≤ 10.0.28000.1719 · ≤ 10.0.28000.1719
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.8957
+4 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-32156Same product: Microsoft Windows 10 1607
CVE-2026-27916Same product: Microsoft Windows 10 1607
CVE-2026-27915Same product: Microsoft Windows 10 1607
CVE-2026-27909Same product: Microsoft Windows 10 1607
CVE-2026-24289Same product: Microsoft Windows 10 1607
CVE-2026-27923Same product: Microsoft Windows 10 1607
CVE-2026-33098Same product: Microsoft Windows 10 1607
CVE-2026-20822Same product: Microsoft Windows 10 1607
CVE-2026-24292Same product: Microsoft Windows 10 1809
CVE-2026-32078Same product: Microsoft Windows 10 1809

References